The Spanish Data Protection Agency has dismissed a procedure initiated against a property owner for installing video surveillance cameras in a rented dwelling, due to insufficient evidence proving the actual processing of personal data.

Facts and context

The Spanish data protection authority (AEPD) published a decision to dismiss a procedure against a property owner, A.A.A., for the alleged unlawful installation of video surveillance cameras in a rented dwelling.

The case originated from a complaint filed on 12 September 2024 by a tenant, who reported the installation of seven cameras with audio recording in the common areas of the dwelling and above the door of her room, without being informed.

Reasons for the decision

The authority examined the situation regarding a potential breach of the obligation to have a legal basis for processing. However, it could not establish any infringement.

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The authority initiated a sanction procedure considering that the installation of cameras inside a private home, infringing on privacy, required a valid legal basis, such as the free, specific, informed, and unambiguous consent of the data subjects. However, investigations, including a police report, did not prove that the cameras were operational at the time of the facts, nor that they had actually recorded or stored images constituting personal data. The accused having sold the property and the cameras no longer being present, any verification was impossible. Applying the presumption of innocence principle, the authority concluded that in the absence of evidence demonstrating data processing, no infringement could be attributed to the owner.

Authority's decision

Consequently, the authority dismissed the procedure against A.A.A.

Lessons learned

This decision reminds that:

• The mere presence of an image capture device is not sufficient to characterize a GDPR violation; it is imperative to demonstrate that this device was operational and actually processed personal data.
• The burden of proof of an infringement lies with the supervisory authority. In the absence of sufficient material evidence, the presumption of innocence benefits the presumed data controller.
• The installation of video surveillance cameras inside a rented dwelling constitutes a particularly serious interference with tenants' right to privacy, protected by national and European laws.
• A data controller cannot merely deny the operation of a system; although in this case the absence of evidence led to dismissal, it is their responsibility to demonstrate compliance, notably the absence of processing.